🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1380d7a41d3a9719116d41942ef92b0fcf1cdc00e12066a9796ac0a5e4552a2d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1380d7a41d3a9719116d41942ef92b0fcf1cdc00e12066a9796ac0a5e4552a2d
SHA3-384 hash: 30e809fb9a8695c67bb5c8c0858aa043fba952c1ce498e9921ed94560b9d69739eeb2a112c495f3176aa9f67b86b5bd1
SHA1 hash: bdf21afb938ef0746945fb843090716bf3caa6c1
MD5 hash: abac4685e9242d39df9e89a0c3ac1aa6
humanhash: floor-harry-alabama-saturn
File name:LetsVPN.zip
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:104'585'019 bytes
First seen:2026-07-03 10:42:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 3145728:QIfax28BgYSXX/lokxkE1yK1NzdzcDrCl/ZLscDl:QYax/1SXX/lofE1yWqmlBYWl
TLSH T1853833A4547CC6F92A6B4B0DD0CE134915E0752A79AF60BCE60834F931AF14EE8FF469
Magika zip
Reporter smica83
Tags:file-pumped ValleyRAT zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
HU HU
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:SetupsHR_6.30_sqojc.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:104'875'733 bytes
SHA256 hash: fb7c212b0b1368f626181f4b2aac8278023da61c72fda69a3fab3954e239ae62
MD5 hash: 8ac0acdee41277d076a2bab8f2cf8b29
De-pumped file size:104'960 bytes (Vs. original size of 104'875'733 bytes)
De-pumped SHA256 hash: 016cc7ef5a4b175b20a4a149d16afbce2e1919bcb8420df984a415b778a8ba1e
De-pumped MD5 hash: d95f95a79f33ffee1e3eb2b940554d40
MIME type:application/x-dosexec
Signature ValleyRAT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/017ff06c-dda9-4819-b10c-2f90e40fa7d6/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a479270762b0b26f3cf5cec
Tags:
n/a
Result
Verdict:
Malicious
File Type:
ZIP File - Malicious
Link:
https://app.docguard.net/1380d7a41d3a9719116d41942ef92b0fcf1cdc00e12066a9796ac0a5e4552a2d/results/dashboard
Behaviour
SuspiciousEmbeddedObjects detected
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug anti-vm autoit base64 crypto evasive evasive expand expired-cert explorer fingerprint installer installer installer-heuristic large-file lolbin lolbin mshta nsis packed reconnaissance runonce wscript
Link:
https://www.filescan.io/uploads/6a479258f76c26f2e6527766/reports/d95e2faa-afd2-4273-bcf0-a6b8d750af2a/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/1380d7a41d3a9719116d41942ef92b0fcf1cdc00e12066a9796ac0a5e4552a2d
Verdict:
Unknown
File Type:
zip
Link:
https://opentip.kaspersky.com/1380d7a41d3a9719116d41942ef92b0fcf1cdc00e12066a9796ac0a5e4552a2d/results?tab=lookup
Score:
34%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/1380d7a41d3a9719116d41942ef92b0fcf1cdc00e12066a9796ac0a5e4552a2d
Gathering data
Threat name:
Win64.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-07-02 17:50:57 UTC
File Type:
Binary (Archive)
Extracted files:
16
AV detection:
10 of 38 (26.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=coanpja5hklrselnigkc56jlb7hrzxaa4eqgnklznlaklzcvfiwq._file
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 adware backdoor discovery execution persistence ransomware spyware
Link:
https://tria.ge/reports/260703-m1jymacw3k/
Behaviour
Checks SCSI registry key(s)
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Boot or Logon Autostart Execution: Active Setup
Detects ValleyRAT payload
Family: ValleyRat
Malware Config
C2 Extraction:
43.248.172.115:16443
43.248.172.115:5443
127.0.0.1:80
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments